Cyber Resilience

CVE-2025-22912

CriticalPublic PoCRCE

Published: 16 January 2025

Published
16 January 2025
Modified
09 April 2025
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0293 86.7th percentile
Risk Priority 21 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-22912 is a critical-severity Command Injection (CWE-77) vulnerability in Edimax Re11S Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 13.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

RE11S v1.11 contains a command injection vulnerability in the /goform/formAccept component, tracked as CVE-2025-22912 and assigned CWE-77. The flaw received a CVSS 3.1 score of 9.8, reflecting network attack vector, low attack complexity, and no requirements for authentication or user interaction, with impacts spanning confidentiality, integrity, and availability.

Remote, unauthenticated attackers can supply crafted input to the affected endpoint and execute arbitrary commands on the device. Successful exploitation grants full control over the target system, consistent with the high-severity rating.

The listed references point to the vendor site, a public proof-of-concept repository, and the manufacturer homepage but contain no published patches, workarounds, or mitigation guidance. The associated EPSS score remains low, moving only from 0.0293 to a peak of 0.0404.

EU & UK References

Vulnerability details

RE11S v1.11 was discovered to contain a command injection vulnerability via the component /goform/formAccept.

CWE(s)
CWE-77

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
Why these techniques?

Remote unauthenticated command injection in public-facing web component (/goform/formAccept) enables T1190 (Exploit Public-Facing Application) for initial access and T1059.004 (Unix Shell) for arbitrary command execution on the embedded device.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-22905Same product: Edimax Re11S
CVE-2025-22904Same product: Edimax Re11S
CVE-2025-22913Same product: Edimax Re11S
CVE-2025-22907Same product: Edimax Re11S
CVE-2025-22916Same product: Edimax Re11S
CVE-2025-22906Same product: Edimax Re11S
CVE-2025-70161Same vendor: Edimax
CVE-2024-48419Same vendor: Edimax
CVE-2025-15256Same vendor: Edimax
CVE-2024-48418Same vendor: Edimax

Affected Assets

edimax
re11s firmware
1.11

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly prevents command injection vulnerability by validating and sanitizing user inputs to the /goform/formAccept component against whitelists or expected patterns.

SI-2 Flaw Remediation good match
prevent

Requires timely identification, reporting, and patching of the specific command injection flaw in RE11S v1.11 firmware to eliminate the vulnerability.

SC-7 Boundary Protection partial match
prevent

Mitigates remote unauthenticated exploitation by monitoring and controlling network communications to the vulnerable /goform/formAccept endpoint at system boundaries.

References